Emails that have an empty "envelope from" needs to be blocked.
Email Security.cloud
There is currently no way to block messages where the envelop sender is blank. However, If you need to address impersonation messages/scams, the sender authentication would help. Also, for preventing domain-based email spoofing, the following document would be useful:
178783: Prevent domain-based email spoofing with Email Security.cloud